Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing airport security via SQL injection

ian.sh

Post reply on HN
Print view View original

311–320 of 459 posts

Re: Bypassing airport security via SQL injection

#311

Post by rjh29 »

qazxcvbnmlp wrote: post #101

Accessing CASS is a big deal, and should be fixed but you’re gonna need more than this to board an aircraft. Also… you can fix all the SQL issues, but you’re still not going to be able to fix the “men in hoodies with a big wrench talk to an authorized administrator (while their kids are kidnapped in Mexico)”

At the very least it sounds like you can get the password of many users (MD5 isn't exactly secure) and if they're sharing passwords then that's bad for them. You can also gain admin access and mess around with the site practically undetected for an indefinite amount of time.

Re: Bypassing airport security via SQL injection

#312

Post by rjh29 »

jrochkind1 wrote: post #45

> We had difficulty identifying the right disclosure contact for this issue. We did not want to contact FlyCASS first as it appeared to be operated only by one person and we did not want to alarm them. Wait, what? Is this a euphemism for they didn't believe they would take it seriously? Reporting it over their heads to DHS was probably not less "alarming" to anyone...

Real reason: the dev would fix it and they'd be stuffed. That doesn't encourage the DHS to actually look into the issue and see what else is broken.

Re: Bypassing airport security via SQL injection

#313

Post by more_corn »

james_marks wrote: post #279
stackskipton wrote: post #267

Earlier quoted context omitted.

I'll say they are worthless because most of time they are dragging time away from things that could improve security. For example, $LastJob we spent a ton of time on SOC2 compliance and despite having applications with known vulnerabilities, we got hacked and ended up all over the news. Maybe of instead of spending all the time getting SOC2 compliance finished, we could have worked at upgrading those apps. Actually,…

SOC2 covers a set of vectors (mostly social/separation of controls from what I’ve seen), and you were attacked on another vector. Maybe the org prioritized poorly and sucks overall, but that doesn’t mean SOC2 or compliance generally is worthless.

In this particular case it was worthless. If you have known vulnerabilities and you deprioritize that work to waste time on soc2, and get hacked because of it… soc2 was worthless. Because the whole point is security assurance. When you get hacked you’ve proved the opposite of security assurance.

But also you gotta have the balls to stand up to the guy pushing soc2 and say. No. There are known vulnerabilities. We are patching those first then we are doing soc2. The way I frame it is “we know we have critical vulnerabilities, we don’t need to go hunting for more till we fix them. Once we fix them we go looking for other ways to improve security posture” And if the ceo still insists (big client requires it so we’re doing soc2 simultaneously) you say fine, then hire a security consultant so we can go twice as fast. And if he refuses you quit because fuck that place.

Re: Bypassing airport security via SQL injection

#314

Post by wouldbecouldbe »

_yb2s wrote: post #18

Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes into reading about web programming- and that every decent quality web framework automatically prevents. It is really telling that they try to cover up and deny instead of fix it, but not surprising. That is a natural consequence of authoritarian thinking, which is the entire premise…

True but even though I’ve always been careful to escape sql, I’ve also made an oversight once by writing a custom SQL filter and missing to escape it. The code reviews also missed it (we were so used to the framework solving it for us). Luckily a pen test found it and was only shortly in production.

Re: Bypassing airport security via SQL injection

#315

Post by more_corn »

cratermoon wrote: post #217
not2b wrote: post #179

Earlier quoted context omitted.

MS could have provided security hooks similar to BPF in Linux, and similar mechanisms with Apple, rather than having Crowdstrike run arbitrary buggy code at the highest privilege level.

They could have, however the timeline the regulators gave Microsoft to comply was incompatible with the amount of work required to build such system. With a legal deadline hanging over their heads Microsoft chose to hand over the keys to their existing tools.

^ This statement cannot be accepted without proof. It sounds outlandish and weird. Which regulator? Under what authority. Also Microsoft doesn’t listen to ANYBODY.

Re: Bypassing airport security via SQL injection

#316

Post by [deleted] »

woodruffw wrote: post #41
macNchz wrote: post #24

Earlier quoted context omitted.

What was surprising to me was that they didn't immediately do pre-dawn raids on the pentesters' homes and hold them without a lawyer under some provision of an anti-terror law.

That's not really how this works. TSA is maliciously incompetent, but there is a reporting pipeline and procedure for these things that's formalized and designed to protect exactly this kind of good-faith reporting[1]. (It's very easy to believe the worst possible thing about every corner of our government, since every corner of our government has something bad about it. But it's a fundamental error to think that eve…

[deleted]

Re: Bypassing airport security via SQL injection

#317

Post by 8bitsrule »

_yb2s wrote: post #18

Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes into reading about web programming- and that every decent quality web framework automatically prevents. It is really telling that they try to cover up and deny instead of fix it, but not surprising. That is a natural consequence of authoritarian thinking, which is the entire premise…

Looks to me like there's a reason this vulnerability exists ... for example, to help certain people have a simple way to avoid TSA searches and/or credential checks.

Re: Bypassing airport security via SQL injection

#318

Post by wouldbecouldbe »

woodruffw wrote: post #7

The TSA's response here is childish and embarrassing, although perhaps unsurprising given the TSA's institutional disinterest in actual security. It's interesting to see that DHS seemingly (initially) handled the report promptly and professionally, but then failed to maintain top-level authority over the fix and disclosure process.

It’s very hard for management, even IT managers, to fully understand what such things mean.

I’ve seen huge issues, like exposed keys, being treated as a small issue. While an outdated js library, or lack of ip6 support being escalated.

I’m sure TSA and their partners wants to downplay potential exposure, I’m also sure it’s hard for a lot of their managers to fully understand what the vulnerability entails (most likely their developers are downplaying their responsibility and pointing fingers at others)

Re: Bypassing airport security via SQL injection

#319

Post by 77pt77 »

4gotunameagain wrote: post #21

The safety of airports and air travel compromised by a simple SQL injection ? What is it, the year 2000 ? It should be a criminal offence for whoever developed that system.

If there are any criminal charges here it will be for the reporters. Not the developers.

To think otherwise is beyond naive.

Re: Bypassing airport security via SQL injection

#320

Post by 77pt77 »

bubblethink wrote: post #253
rootusrootus wrote: post #22

Earlier quoted context omitted.

It doesn't seem particularly unique to TSA. Flying elsewhere in the world has essentially identical security screening, with all the same stupidity. I'm a little butthurt right now, in particular, about the security at Heathrow. They confiscated a bottle of whisky that we got in Edinburgh. After 10 minutes of head-scratching and consulting with a supervisor, they concluded that "it does not say 100ml" (it had "10cl"…

>It doesn't seem particularly unique to TSA. Flying elsewhere in the world has essentially identical security screening, with all the same stupidity. That's largely due to the US and 9/11. In fact, the US even pressures other countries into creating a separate mini TSA at their boarding gate for flights that fly into the US.

You are confusing TSA with CBP.

Some countries allow you to clear CBP on the boarding side, skipping it at the destination.

It's like Ireland/Dublin, Aruba and a few others.

Post reply on HN